1. Field of Invention
The present invention relates to a virtual machine technology, in particular, to a secure input method based on a virtual machine.
2. Description of Prior Art
In a computer system, when a user inputs data by the keyboard, the device driving program for the keyboard converts the key-pressing event to a corresponding key value and saves it in a buffer memory for inner kernel, then the key value waits until a keyboard hook acquires and stores it into an application reception buffer area. Meanwhile, the computer system generally allows a keyboard filtering driver to intercept the keyboard input event after the keyboard driving, performs special conversion or processing on the keyboard input event and then saves the converted key value in the buffer memory for inner kernel. The computer system allows only one application to obtain the keyboard input focus each time.
During the above flow of a user program receiving a keyboard input, that is, keyboard input->keyboard driver->keyboard filtering driver->buffer memory for inner kernel->keyboard hook->application reception buffer area, since there lacks protective measure for output of the keyboard driver and content in the buffer memory for inner kernel, the data inputted from the keyboard is likely to be acquired by keyboard filtering drivers and keyboard hook of any other computer invasion program. Various Trojan horse programs and eavesdropping programs utilize different filtering driver and keyboard hooks to obtain a user input so as to acquire sensitive data, for example, password, inputted by the user.
On a virtual machine, a keyboard input is first obtained by a virtual machine monitor (VMM), then a keyboard hardware event is sent to a client-end OS through a simulated keyboard device. Like a standard OS, the client-end OS provides the keyboard input to an application through the same flow of keyboard driver->keyboard filtering driver->buffer memory for inner kernel->keyboard hook->application reception buffer area, during which various Trojan horse programs and eavesdropping programs can also utilize filtering driver and different hooks to obtain the user input.
As can be seen from the above introduction, there exists serious security bugs in the keyboard input mechanism for the existing virtual machine, and user input lacks sufficient protection.